Is there Prohibited Data in your computers? Find out!
Data breaches are big news and are very costly. At Stanford, most breaches of private information have been from computers where no one expected that data to be.
Identity Finder is a commercial product that scans computers to locate sensitive data such as Social Security numbers and credit card numbers.
With the support of the Vice President for Business Affairs, the Information Security Office and IT Services have obtained a limited-time license to run Identity Finder on all Stanford employees' computers to identify where this data may be unknowingly be stored.
The Initiative
University senior management is committed to avoiding unintentional disclosure of protected information such as Social Security numbers and credit card numbers, as has recently happened at many of our peer institutions. While Stanford has taken a number of steps to prevent this kind of disclosure, the Information Security Office is still contacted from time to time with potential breaches, and often no one even expected the data was being stored on the computer involved!
In order to locate and inform schools and departments of Social Security numbers and credit card numbers that are stored on their computers, senior management has centrally funded a limited-time license to run a product called Identity Finder that scans computers to locate this risky data. IT Services and the Information Security Office has successfully piloted the product in a number of campus departments with good results and no negative impact on the computer users.
We are contacting you at this time to schedule a time to scan your systems. To simplify scanning, Identity Finder can be centrally installed via BigFix. Alternatively, BigFix Console Operators or local IT support personnel are welcome to subscribe computers to Identity Finder themselves; ITS and ISO can provide information on how to do so.
Below are lists of common questions we have recieved from end users and from IT and administrative staff.
The Goal
The goal of this initiative is for Stanford to be first to find this risky data and to be sure it is properly protected so Stanford can avoid any negative reputational consequences because of a breach of protected data.
Self-Scan Option
Would you would like to scan your machine yourself with Identity Finder? Choose the approriate Operating System below to get started.
Download and instructions for Macs
Download and instructions for Windows
Contact Us
Please contact the Identity Finder Project Team so we can begin to plan the scan of your area. If you have any questions, concerns, or advice regarding this initiative, please feel free to contact the project team at idfinder-support@lists.stanford.edu or alternatively Stanford's Chief Information Security Officer, Tina Darmohray at tmd@stanford.edu We appreciate your help with this important initiative!
FAQ's from End Users
FAQ for IT staffQ: What is Identity Finder?
- A: Identity Finder is a program that searches your computer for social security numbers and credit card numbers.
Q: Why is Stanford using Identity Finder?
- A: Data breaches are big news and are very costly. At Stanford, most breaches of private information have been on computers where no one expected that data to be. Stanford is providing the Identity Finder tool to help individuals and departments proactively locate this data so it can be removed or secured.
Q: Will I be able to tell that Identity Finder is on my machine?
- A: On Windows, there will be an Identity Finder icon that will show up in your start menu. On Macs, the Identity Finder icon will show in your apps folder.
Q: Who approved the Identity Finder project?
- A: The Information Security Office has reviewed Identity Finder and approved it for use in locating social security numbers and credit card numbers.
Q: How long will the Identity Finder software be on my machine(s)?
- A: Currently the Identity Finder software will be available through September 2013 for individuals and departments to self-scan.
Q: Will Identity Finder impact my machine?
- A: Identity Finder is installed on the machine, and preforms a one-time scan following installation. We've run an Identity Finder pilot and have had no negative impact reported.
Q: Will Identity Finder scans be ongoing?
- A: A limited-time license of Identity Finder has been centrally funded. Individuals and Departments are urged to run their scans before the end of May 2013.
Q: Who will have access to the results?
- A: Self-scan results can be seen by you and only the masked data (last four (4) digits) is sent to a secure server and may be reviewed by the Information Security Office. Only designated IT administrators will be able to see the file location and type of hit in order to assist users with removing or securing the data. The actual contents of the file is never revealed and cannot be seen by anyone but you.
Q: Am I required to run Identity Finder?
- A: Stanford's senior management has made locating and removing or securing data such as social security numbers and credit card numbers a priority and is providing Identity Finder as a tool to help individuals and departments do so.
Q: What if individuals or departments don't want to participate in this project?
- A: The University recently launched a "no harm, no foul" initiative to protect Stanford and its employees from being the victim of an unintended data breach often associated with a lost or stolen machine. The initiative involves use of Identity Finder, an application that scans computers to determine whether high-risk data resides on the hard drive. The goal is for Stanford to be first to find high-risk Stanford data and ensure it is properly protected, bringing all computers into compliance with the Data Classification Guidelines. Individuals or departments can contact the University CISO, Tina Darmohray, tmd@stanford.edu, if they have additional questions about Identity Finder.
Back to top.
FAQ's from IT/Admin Staff
FAQ for end usersQ: What is Identity Finder?
- A: Identity Finder is a program that searches your computer for social security numbers and credit card numbers.
Q: How much does Identity Finder cost?
- A: Stanford has obtained a limited-time license to run Identity Finder on all Stanford employees' computers to identify where this data may be unknowingly be stored.
Q: Why is Stanford using Identity Finder?
- A: Data breaches are big news and are very costly. At Stanford, most breaches of private information have been on computers where no one expected that data to be. Stanford is providing the Identity Finder tool to help individuals and departments proactively locate this data so it can be removed or secured.
Q: Will servers be included in these scans?
- A: Servers and remote shares are not included in the default scan. The Identity Finder client does allow for manual scanning of network shares and servers, for more details please contact the Identity Finder team idfinder-support@lists.stanford.edu
Q: Can our group scan for more than just social security or credit card numbers?
- A: The Identity Finder client can be run manually from any host to scan for any data your group would like to look for. If you would like to scan more broadly for other types of data, please contact the Identity Finder team idfinder-support@lists.stanford.edu
Q: Our group does not have local IT, will someone run Identity Finder for us?
- A: If you need assistance to run Identity Finder, please contact the Identity Finder team idfinder-support@lists.stanford.edu
Q: What is required to deploy Identity Finder?
- A: BigFix can be used to deploy and install Identity Finder, but it is not required. Once Identity Finder is installed, it will automatically start the one-time scan. If you need assistance to run Identity Finder, please contact the Identity Finder team idfinder-support@lists.stanford.edu
Q: Who approved the Identity Finder project?
- A: The Information Security Office has reviewed Identity Finder and approved it for use in locating social security numbers and credit card numbers.
Q: How long will Identity the Finder software be on my machine(s)?
- A: Currently the Identity Finder software will be available through September 2013 for individuals and departments to self-scan. At the expiration of the license, the Identity Finder software will cease to function and the software will be removed with the same method with which it was installed (eg. if BigFix installed Identity Finder, then it can be removed via BigFix).
Q: Will Identity Finder impact my machine?
- A:Identity Finder is installed on the machine, and preforms a one-time scan following installation. We've run an Identity Finder pilot and have had no negative impact reported.
Q: Will Identity Finder scans be ongoing?
- A: A limited-time license of Identity Finder has been centrally funded. Individuals and Departments are urged to run their scans before the end of May 2013.
Q: Who will have access to the results?
- A: Self-scan results can be seen by you and only the masked data (last four (4) digits) is sent to a secure server and may be reviewed by the Information Security Office. Only designated IT administrators will be able to see the file location and type of hit in order to assist users with removing or securing the data. The actual contents of the file is never revealed and cannot be seen by anyone but you.
Q: Is my group/department/school required to run Identity Finder?
- A: Stanford's senior management has made locating and removing or securing data such as social security numbers and credit card numbers a priority and is providing Identity Finder as a tool to help individuals and departments do so.
Q: What if individuals or departments don't want to participate in this project?
- A: The University recently launched a "no harm, no foul" initiative to protect Stanford and its employees from being the victim of an unintended data breach often associated with a lost or stolen machine. The initiative involves use of Identity Finder, an application that scans computers to determine whether high-risk data resides on the hard drive. The goal is for Stanford to be first to find high-risk Stanford data and ensure it is properly protected, bringing all computers into compliance with the Data Classification Guidelines. Individuals or departments can contact the University CISO, Tina Darmohray, tmd@stanford.edu, if they have additional questions about Identity Finder.
Back to user's FAQ
Back to top.